spontaneous-manatee-e1e35c[.]netlify[.]app

The domain spontaneous-manatee-e1e35c.netlify.app was created on October 19, 2025 and is registered through Netlify. It resolves to the IP address 35.157.26.135, which belongs to Amazon.com, Inc. (AS16509) and is geolocated in Germany. DNS resolution is delegated to dns1.p04.nsone.net and dns2.p04.nsone.net, indicating the use of NSONE’s name‑service. The site presents a TLS certificate issued by DigiCert Inc., specifically the DigiCert Global G2 TLS RSA SHA256 2020 CA1 chain, confirming that HTTPS is correctly configured despite the underlying content being unavailable.

An HTTP request returns a 404 status code, and the page title captured during scanning is "WeTransfer," matching the declared brand target of WeTransfer and confirming a brand‑impersonation intent. Automated analysis identified Netlify hosting and the presence of HSTS headers, typical of legitimate Netlify deployments, which may be leveraged to lend credibility to the malicious page. VirusTotal records show that 16 of 95 security vendors have flagged the domain, and it appears on one public blocklist, with PhishDestroy explicitly listing it as blocked. The domain is currently marked offline, but historical evidence suggests it was actively serving malicious content before takedown.

Risk assessment places the site at an elevated level, consistent with its brand‑impersonation classification. Defenders should continue to block the domain at network perimeter devices, update URL filtering feeds to include the listed blocklist entry, and monitor for any re‑registration attempts under similar subdomains. Incident response teams should also review logs for connections to 35.157.26.135 and consider implementing host‑based indicators of compromise derived from the SSL fingerprint and DNS records.